CVE-2026-55502
Received Received - Intake

Stored XSS in Cloudreve via OAuth Policy Manipulation

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not add the local Admin.Write guard used by sibling policy mutation routes. Its handler persists attacker-supplied secret and app_id values into the selected OneDrive storage policy before returning an OAuth URL. This issue is fixed in version 4.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-55502
EUVD
EUVD-2026-51394

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cloudreve cloudreve 4.17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cloudreve before 4.17.0 has an issue where the POST /api/v4/admin/policy/oauth/signin endpoint only requires Admin.Read permission. This allows an attacker with Admin.Read to modify storage policy credentials by supplying a OneDrive secret and app_id, even without Admin.Write permission. The vulnerability exists because the endpoint persists attacker-controlled values into the OneDrive storage policy before returning an OAuth URL.

Detection Guidance

Check Cloudreve version for outdated installations below 4.17.0. Inspect admin policy mutation routes for unauthorized OAuth token modifications. Monitor logs for unexpected storage policy credential changes.

Impact Analysis

An attacker with Admin.Read access could exploit this to change storage policy credentials, potentially redirecting file storage to a malicious OneDrive account. This could lead to unauthorized access to sensitive files or data exfiltration. The impact includes loss of data integrity and confidentiality.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) and HIPAA (health data security) by allowing unauthorized access to sensitive data. It undermines access controls and data integrity, which are critical for meeting regulatory standards.

Mitigation Strategies

Upgrade Cloudreve to version 4.17.0 or later. Review and restrict Admin.Read permissions. Audit storage policy credentials for unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart